Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Possible Duplicate:
Multiple hops SSH tunnel…

Here's the setup:

desktop: my desktop. I have root and can do anything I want. Kubuntu 10.04.

bastion: a bastion host that only allows inbound SSH connections on port 22. I do not control this server. I cannot write files anywhere on this server. The only commands available to me are ssh and shell (bash) builtins. CentOS.

server: a server with a file on it that I want to retrieve (i.e. copy to desktop). Only allows incoming SSH connections from bastion. Does not allow outgoing ssh connections. CentOS.

I can ssh from desktop to bastion, and then ssh from bastion to server. I can set up an SSH tunnel on B as follows:

ssh -fNL 30000:localhost:22 server

And then the following allows me to connect to server from bastion:

bastion % ssh localhost -p 30000

But this does not work (bastion refuses the connection):

desktop % ssh bastion -p 30000

I'm wondering if there's some way I can turn an ssh session from desktop to bastion into a tunnel that connects to port 30000 locally on bastion, so that I can then go through that connection to get to server. If bastion allowed incoming connections on high ports, I could do it, but it doesn't, only port 22.

I know that there's other options: I could cat the target file to my screen and save it out locally, but this is a hack (and annoying if there's binary data in the file).

EDIT: I figured out one stupid solution:

bastion % ssh server "cat filename1" | ssh localhost "cat > filename2"

This works, although the ssh prompts (are you sure you want to connect, yes/no? and the password) get in each others' way so you have to type "yes" and the various host passwords in the correct order). But it would be nice if I could tunnel through to server from desktop.

share|improve this question

marked as duplicate by Ignacio Vazquez-Abrams, studiohack Jun 8 '11 at 22:41

This question was marked as an exact duplicate of an existing question.

First, connect to bastion and set up a tunnel from desktop -> bastion
ssh -L 30000:localhost:30000 bastion

Now set up a tunnel from bastion -> server by running this on bastion
ssh -L 30000:localhost:22 server

Now you can sftp server:30000:/path/to/the/file/you/want.txt to pull the file into your current directory.

The first two commands can be simplified by just running
ssh -L 30000:localhost:30000 bastion ssh -L 30000:localhost:22 server
from the desktop I think.


Try ssh -L 30000:server:22 bastion

share|improve this answer
The first command doesn't work; bastion won't accept an incoming SSH request on port 30000. – dirtside Jun 8 '11 at 20:56
I just thought of something, see my modified commands. – Darth Android Jun 8 '11 at 21:02

Not the answer you're looking for? Browse other questions tagged .